CVE-2026-106195

Executive Summary

CVE-2026-106195 is an incorrect authorization vulnerability (CWE-863) in the Chromoting component of Google Chrome on macOS. A remote attacker can bypass system access restrictions by sending crafted network traffic, undermining the authorization checks that normally gate access to the Chromoting subsystem. The impact is limited in scope (Chromium security severity: Low), but any authorization bypass in a remote-access component warrants attention because it can weaken the security boundary between a remote peer and the local macOS host.

Technical Analysis

Chromoting is the technology underpinning Chrome Remote Desktop, Google's remote desktop access solution for Chrome and Chromium-based browsers. In the affected configuration, the Chromoting component runs within Google Chrome on macOS and is responsible for brokering connections between a remote client and the local host session. The vulnerability is categorized as CWE-863 (Incorrect Authorization), meaning the component fails to correctly enforce an authorization decision — it either checks the wrong property, trusts a client-supplied value it should not, or omits a necessary authorization check on a code path reachable by crafted network traffic.

The NVD description states that the flaw "allowed a remote attacker to bypass system access restrictions via crafted network traffic" and is present in Chrome on macOS prior to 155.0.8059.39. This indicates the attack surface is the network-facing interface of Chromoting: a remote peer that can deliver traffic to the Chromoting endpoint may be able to cause the authorization logic to grant access it should not, thereby circumventing the "system access restrictions" that are intended to constrain remote sessions on the macOS host.

Because the CNA description is intentionally sparse (Google typically publishes minimal advisories for Chrome security fixes), no specific function names, class names, URL endpoints, API paths, or parameter names are available from the supplied data. Consequently, the precise implementation error — for example whether the defect lies in a capability check, a per-session permission validation, or host-level policy enforcement — cannot be asserted from the data provided. What can be stated with confidence is the vulnerability class: an authorization enforcement defect reachable over the network that results in the bypass of access restrictions on the host.

The Chromium severity rating is "Low," which reflects a constrained impact profile. This likely indicates that the bypass does not directly yield code execution or full host compromise, but rather grants an unauthorized degree of access within the scope of what Chromoting itself can reach. The interaction model (browser-mediated, user-driven remote session establishment) also limits the reachable attacker population compared to a fully unauthenticated network service.

No CVSS vector was provided by the source data; the vector shown in METADATA is a conservative analytical estimate for an authorization bypass (network-reachable, low complexity, no privileges required, no user interaction, limited confidentiality impact) and should not be treated as a vendor-assigned score. No EPSS score has been published, and there is no evidence of public PoC, exploit code, or a Nuclei template.

Exploitation Scenarios

The following attack chain is inferred strictly from the vulnerability class and the NVD description; no public PoC exists.

1. Reconnaissance / target identification. An attacker identifies a macOS host that exposes the Chromoting/Chrome Remote Desktop service. This may be a host reachable over the network or, more commonly, a host whose remote-access endpoint the attacker can reach through a network position (e.g., the same LAN, a VPN, or a remote-access deployment). Target identification is based on the presence of the Chromoting listener or the Chrome Remote Desktop web interface.

2. Triggering the authorization flaw. The attacker crafts network traffic directed at the Chromoting endpoint. Because the component performs an incorrect authorization check (CWE-863), the crafted traffic causes the authorization decision to resolve incorrectly — granting the session access that policy should deny. The specific message structure, fields, or request parameters that trigger the flaw are not enumerated in the available data.

3. Payload/execution at the vulnerability-class level. The "payload" in an authorization bypass is not a memory-corruption payload but a request that satisfies the flawed logic. The attacker's crafted traffic is the exploit primitive: it causes the component to accept an action or establish a session that the correct authorization logic would have refused, thereby bypassing the "system access restrictions" referenced in the advisory.

4. Post-exploitation impact. Successful exploitation grants the remote attacker an unauthorized level of access to the macOS host through Chromoting — effectively bypassing the access restrictions that the system is supposed to enforce. The advisory does not characterize the resulting capabilities further. The Chromium severity of "Low" suggests the resulting access is bounded, but any authorization bypass in a remote-access component can serve as a foothold for lateral movement or further local access attempts.

No public PoC is available; the attack chain is inferred from the vulnerability class (CWE-863, incorrect authorization) and the sparse advisory text.

Impact Assessment

Business impact: A remote attacker able to reach the Chromoting interface of an affected macOS host may bypass system access restrictions, potentially gaining unauthorized remote access to the host session. For organizations using Chrome Remote Desktop for remote administration or support, this weakens the access control boundary for managed macOS endpoints.

Affected systems: Google Chrome running on macOS at versions prior to 155.0.8059.39, specifically the Chromoting subsystem. Chrome OS, Windows, and Linux builds are not indicated as affected by this advisory.

Blast radius: Scoped to hosts where the Chromoting endpoint is reachable by an untrusted party. Because exploitation requires network reachability to the component, exposure is a function of network architecture and whether remote access is internet-facing or restricted.

Subscores (analytical estimate, not vendor-assigned): No CVSS score or vector was provided. Based on the description (network-reachable, low complexity, no privileges required, no user interaction, limited confidentiality/integrity impact), a plausible estimate is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (range 5.3–6.5 under CVSS 3.1 depending on CIA selection). This estimate is analytical and must not be reported as the vendor score.

Severity context: Chromium security severity is Low; CISA KEV status is NO; no known in-the-wild exploitation evidence was provided.

Detection Guidance

Sigma Rule

title: Potential Google Chrome Chromoting Authorization Bypass (CVE-2026-106195)
id: 5f2c9a1e-7b3d-4c8a-9e21-0d6f4a8b1c33
status: experimental
description: Detects suspicious Chromoting-related process activity on macOS Chrome builds that may indicate attempts to exploit CVE-2026-106195, an incorrect authorization flaw in Chromoting.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106195
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: macos
detection:
  selection_img:
    Image|endswith:
      - '/Google Chrome'
      - '/Google Chrome Helper'
  selection_cmd:
    CommandLine|contains:
      - 'chromoting'
      - 'remoting'
  selection_net:
    DestinationPort:
      - 443
      - 5222
  condition: selection_img and (selection_cmd or selection_net)
falsepositives:
  - Legitimate Chrome Remote Desktop sessions
  - IT administration of managed macOS endpoints
level: low
tags:
  - attack.t1190
  - cve.2026-106195

YARA Rule

rule CVE_2026_106195_Chrome_Chromoting_Authz
{
    meta:
        description = "Detects Google Chrome macOS binaries containing Chromoting remoting components associated with CVE-2026-106195 authorization bypass"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106195"
        date = "2026-01-01"
        severity = "low"

    strings:
        $remoting1 = "remoting" ascii wide nocase
        $remoting2 = "chromoting" ascii wide nocase
        $remote1   = "Chrome Remote Desktop" ascii wide nocase
        $authz1    = "access_restrictions" ascii wide nocase
        $macho     = { FE ED FA CE } // Mach-O 64-bit magic (little-endian)
        $macho2    = { FE ED FA CF } // Mach-O 64-bit magic (big-endian)

    condition:
        (uint32(0) == 0xFEEDFACF or uint32(0) == 0xFEEDFACE) and
        filesize < 200MB and
        2 of ($remoting*) and 1 of ($macho*)
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-106195 Possible Google Chrome Chromoting Authorization Bypass Attempt"; flow:established,to_server; content:"chromoting"; http_uri; nocase; threshold:type both, track by_src, count 10, seconds 60; reference:cve,2026-106195; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106195; classtype:attempted-user; sid:1006195; rev:1;)

Note: Because the exact protocol fields of the Chromoting authorization handshake are not disclosed in the advisory, this rule targets Chromoting/remote-desktop URIs at the HTTP layer and should be tuned against baseline traffic for legitimate Chrome Remote Desktop usage.

Elastic Detection

process where host.os.type == "macos" and
  process.name : ("Google Chrome", "Google Chrome Helper", "Google Chrome Helper (Renderer)") and
  (process.command_line : "*chromoting*" or process.command_line : "*remoting*" or
   process.command_line : "*Chrome Remote Desktop*")

Splunk SPL Query

index=main sourcetype=osquery:results OR sourcetype=XmlWinEventLog
(process_name="Google Chrome" OR process_name="Google Chrome Helper" OR process_name="Google Chrome Helper (Renderer)")
(CommandLine="*chromoting*" OR CommandLine="*remoting*" OR CommandLine="*Chrome Remote Desktop*")
| stats count values(CommandLine) as cmdline values(dest_port) as ports by host, user
| where count > 5

For network-centric detection, correlate against egress connections to known Chrome Remote Desktop infrastructure:

index=network sourcetype=pan:traffic OR sourcetype=zeek_conn
(dest_port=443 OR dest_port=5222)
| search app="chromoting" OR uri="*chromoting*" OR uri="*remoting*"
| stats count dc(src_ip) as unique_sources by dest_ip, uri
| where count > 20

Wazuh OSSEC Rule

<group name="chrome,chromoting,cve-2026-106195,">
  <rule id="1061950" level="4" frequency="6" timeframe="120">
    <if_matched_sid>100000</if_matched_sid>
    <match>chromoting</match>
    <description>CVE-2026-106195: Repeated Chromoting activity on macOS Chrome endpoint - possible authorization bypass attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,pci_dss_10.2.4,</group>
  </rule>

  <rule id="1061951" level="3">
    <decoded_as>json</decoded_as>
    <field name="process.name">Google Chrome Helper</field>
    <field name="process.command_line" type="pcre2">chromoting|remoting</field>
    <description>CVE-2026-106195: Chrome Helper spawned with Chromoting/remoting arguments</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>chrome,chromoting,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The advisory indicates the flaw is addressed in Google Chrome 155.0.8059.39 for macOS, but no patch reference is available from any tracked source in this dataset. Until the fix is confirmed and deployed, treat affected hosts as unpatched.

1) Immediate mitigations

• Update Google Chrome on macOS to 155.0.8059.39 or later and confirm the version via chrome://version. Chrome's built-in updater should pull the fix automatically once the version is available in the release channel.
• If updating is not immediately possible, consider disabling or restricting Chrome Remote Desktop / Chromoting on affected macOS endpoints where remote access is not operationally required.
• Restrict network reachability to the Chromoting endpoint: place it behind a VPN or identity-aware proxy and block direct public exposure.
• Enforce strong authentication (MFA, device posture, conditional access) for remote-access services to add a layer that does not depend on the flawed Chromoting authorization logic.
• Monitor for unexpected or anomalous Chromoting sessions on macOS endpoints.

2) Patch/upgrade steps

• Verify the current Chrome version and force an update check via Chrome menu → About Google Chrome, or update_engine/GoogleSoftwareUpdate on macOS.
• Deploy the fixed build through enterprise device management (MDM) if automatic updates are deferred by policy.
• Validate post-update that chrome://version reports ≥ 155.0.8059.39.
• Where Chrome Remote Desktop is used administratively, rotate any credentials used for remote sessions and review session logs for unauthorized access.

3) Long-term hardening

• Maintain an inventory of macOS endpoints with Chrome Remote Desktop enabled and apply a least-privilege access model.
• Adopt a defined patch SLA for browser components that expose remote-access functionality; do not treat browser updates as low-priority endpoint maintenance.
• Enable detailed logging of remote-access authentication and session events, and forward them to the SIEM with alerting on anomalous patterns.
• Segment remote-access infrastructure so a bypass in one component cannot pivot directly into sensitive internal networks.
• Continuously track Google Chrome release notes and apply security fixes promptly; the sparse advisory text for Chrome CVEs makes timely patching the primary control.

References

1. NVD — CVE-2026-106195: https://nvd.nist.gov/vuln/detail/CVE-2026-106195
2. Google Chrome Releases (stable channel updates): https://chromereleases.googleblog.com/
3. Chrome Release Notes: https://developer.chrome.com/release-notes
4. MITRE CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
5. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

No known threat actor campaigns or exploit-in-the-wild evidence were identified for this CVE. CISA KEV status: NO. No public PoC, exploit code, or Nuclei template is available.